CWE-1279 Details

Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.

Many cryptographic hardware units depend upon other hardware units to supply information to them to produce a securely encrypted result. For example, a cryptographic unit that depends on an external random-number-generator (RNG) unit for entropy must wait until the RNG unit is producing random numbers. If a cryptographic unit retrieves a private encryption key from a fuse unit, the fuse unit must be up and running before a key may be supplied.

Einführungsmodi

Architecture and Design
Implementation : The decision to continue using a cryptographic unit even though the input units to it are not producing valid data will compromise the encrypted result.

Anwendbare Plattformen

Sprache

Name: Verilog (Undetermined)
Name: VHDL (Undetermined)
Class: Not Language-Specific (Undetermined)

Betriebssysteme

Class: Not OS-Specific (Undetermined)

Architekturen

Class: Not Architecture-Specific (Undetermined)

Technologien

Name: Processor Hardware (Undetermined)
Class: Not Technology-Specific (Undetermined)

Häufige Konsequenzen

Mögliche Gegenmaßnahmen

Phases : Architecture and Design
Best practices should be used to design cryptographic systems.
Phases : Implementation
Continuously ensuring that cryptographic inputs are supplying valid information is necessary to ensure that the encrypted output is secure.

Hinweise zur Schwachstellen-Zuordnung

Begründung : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Kommentar : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Verwandte Angriffsmuster

Einreichung

Änderungen